fix(cd): include log writeback readbacks in controlled profile

.gitea/workflows/cd.yaml

@@ -250,6 +250,10 @@ jobs:
                 ;;
               apps/api/src/services/ai_agent_log_feedback_receipt_dry_run.py)
                 ;;
+              apps/api/src/services/ai_agent_log_post_write_verifier_dry_run.py)
+                ;;
+              apps/api/src/services/ai_agent_log_controlled_writeback_plan_readback.py)
+                ;;
               apps/api/src/services/ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/src/services/awooop_ansible_audit_service.py)
@@ -330,6 +334,10 @@ jobs:
                 ;;
               apps/api/tests/test_ai_agent_log_feedback_receipt_dry_run_api.py)
                 ;;
+              apps/api/tests/test_ai_agent_log_post_write_verifier_dry_run_api.py)
+                ;;
+              apps/api/tests/test_ai_agent_log_controlled_writeback_plan_readback_api.py)
+                ;;
               apps/api/tests/test_ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/tests/test_awooop_truth_chain_service.py)
@@ -505,6 +513,8 @@ jobs:
               src/services/agent_replay_normalizer.py \
               src/services/ai_agent_log_intelligence_integration_readback.py \
               src/services/ai_agent_log_feedback_receipt_dry_run.py \
+              src/services/ai_agent_log_post_write_verifier_dry_run.py \
+              src/services/ai_agent_log_controlled_writeback_plan_readback.py \
               src/services/ai_agent_autonomous_runtime_control.py \
               src/services/awooop_ansible_audit_service.py \
               src/services/awooop_ansible_check_mode_service.py \
@@ -550,6 +560,8 @@ jobs:
               tests/test_agent_replay_normalizer.py \
               tests/test_ai_agent_log_intelligence_integration_readback_api.py \
               tests/test_ai_agent_log_feedback_receipt_dry_run_api.py \
+              tests/test_ai_agent_log_post_write_verifier_dry_run_api.py \
+              tests/test_ai_agent_log_controlled_writeback_plan_readback_api.py \
               tests/test_ai_agent_autonomous_runtime_control.py \
               tests/test_awooop_truth_chain_service.py \
               tests/test_shadow_auto_approve.py \

docs/LOGBOOK.md

@@ -1,3 +1,16 @@
+## 2026-06-29 — 21:25 CD profile fix for log writeback readbacks
+
+**照優先順序處理**：
+- Gitea main 已推進到 log post-write verifier dry-run 與 controlled writeback plan readback；兩個新 API/service 已接上，但 controlled-runtime CD profile 尚未把新 service / test 納入 allowlist、`py_compile` 與 focused pytest。
+- 補齊 `.gitea/workflows/cd.yaml` controlled-runtime 路徑，並在 `ops/runner/test_cd_controlled_runtime_profile.py` 加回歸測試，鎖住 `ai_agent_log_post_write_verifier_dry_run.py` 與 `ai_agent_log_controlled_writeback_plan_readback.py` 不得再掉到錯 profile。
+- 最新 P0-006 source truth 已是 StockPlatform freshness / ingestion `ok`、readiness `82`、active blocker 只剩 `host_boot_observation_older_than_target_window`；同步修正 Delivery Workbench 測試，不回退 21:15 recovery evidence。
+
+**驗證**：
+- Focused pytest：P0-006 scorecard / Delivery Workbench / log feedback / post-write verifier / controlled writeback plan / log intelligence / CD profile / scorecard script `39 passed`。
+- `py_compile`、`ruff check`、Gitea runner pressure guard、Gitea secret env guard、`git diff --check`：通過。
+
+**邊界**：未觸發 workflow_dispatch；未操作 host / Docker / K8s / DB / firewall；未使用 GitHub / `gh` / GitHub API；未讀 secret / token / raw sessions / SQLite / `.env`。
+
 ## 2026-06-29 — 21:15 P0-006 Stock freshness recovered / reboot SLO still needs fresh boot window
 
 **照優先順序讀回的真相**：

ops/runner/test_cd_controlled_runtime_profile.py

@@ -115,6 +115,30 @@ def test_ai_log_feedback_receipt_stays_on_controlled_runtime_profile() -> None:
         assert source in text
 
 
+def test_ai_log_post_write_verifier_stays_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "apps/api/src/services/ai_agent_log_post_write_verifier_dry_run.py)",
+        "apps/api/tests/test_ai_agent_log_post_write_verifier_dry_run_api.py)",
+        "src/services/ai_agent_log_post_write_verifier_dry_run.py",
+        "tests/test_ai_agent_log_post_write_verifier_dry_run_api.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
+def test_ai_log_controlled_writeback_plan_stays_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "apps/api/src/services/ai_agent_log_controlled_writeback_plan_readback.py)",
+        "apps/api/tests/test_ai_agent_log_controlled_writeback_plan_readback_api.py)",
+        "src/services/ai_agent_log_controlled_writeback_plan_readback.py",
+        "tests/test_ai_agent_log_controlled_writeback_plan_readback_api.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_awooop_ansible_check_mode_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     expected_sources = [